Numerous tools have been developed to aid in network management involving capacity planning, fault management, network monitoring, and performance measurement. One example of such tools is the network analyzer.
In general, a “network analyzer” is a program that monitors and analyzes network traffic, detecting bottlenecks and problems. Using this information, a network manager can keep traffic flowing efficiently. A network analyzer may also be used to capture data being transmitted on a network. The term “network analyzer” may further be used to describe a program that analyzes data other than network traffic, or may also be used to classify packets into flows. For example, a database can be analyzed for certain kinds of duplication. One example of a network analyzer is the SNIFFER ANALYZER® device manufactured by NETWORK ASSOCIATES, INC®.
Most network analyzers are based on a remote monitoring (RMON) standard that has defined nineteen groups in order to characterize network communications profiles and operation states, ranging from the data-link layer up to the applications layer.
There is a current trend for more and more network interface card (NIC) vendors to provide some RMON functions, such as a statistics group function at the data-link layer. Such a function, for example, collects numbers for distribution of packet sizes (i.e. the number of packets whose lengths are less than 64 byte, 128 byte, or other sizes), packet types (i.e. unicast, multicast, or broadcast), etc.
As more and more NIC vendors provide some RMON functions, there is a need for RMON system vendors to leverage the NIC-based statistics group. In this way, the RMON system vendor can concentrate on other RMON functions, which already impose many technical challenges to be implemented in the context of high-speed gigabit network traffic. In other words, there is a need for offloading RMON functions such as the RMON statistics group to the NIC hardware, so that other network analyzer hardware may focus on other RMON functions with improved performance.
Unfortunately, the NIC-based statistics group often provides different network results than other RMON functions, due to the processing capability gap between the NIC hardware and the hardware platform used to implement the rest of the RMON functions. In particular, the NIC hardware may drop a different amount of packets with respect to the hardware platform used to implement the rest of the RMON functions. This “gap” can become wider as the network speed increases, and can cause inconsistencies among results from hardware platforms with different capacities.
There is thus a need to bridge this gap in order to provide a more meaningful RMON profile.